diff --git a/de/heat-templates/scripts/instance_boot.sh b/de/heat-templates/scripts/instance_boot.sh
index 7a7a835..5d2cb9b 100644
--- a/de/heat-templates/scripts/instance_boot.sh
+++ b/de/heat-templates/scripts/instance_boot.sh
@@ -234,8 +234,10 @@
     fi
     install_pkgs $pkg_list
     # Since version 4 yq uses another syntax
-    curl --retry 6 --retry-delay 5 -L ${BINARY_BASE_URL}/openstack/bin/utils/yq/yq-v3.3.2 -o /usr/bin/yq
-    chmod +x /usr/bin/yq
+    if [[ ! -f /usr/bin/yq ]]; then
+        curl --retry 6 --retry-delay 5 -L ${BINARY_BASE_URL}/openstack/bin/utils/yq/yq-v3.3.2 -o /usr/bin/yq
+        chmod +x /usr/bin/yq
+    fi
 }
 
 function enable_iscsi {
diff --git a/trymos/image_build/files/usr/share/trymos/launch.sh b/trymos/image_build/files/usr/share/trymos/launch.sh
index e07c46f..ff6002f 100755
--- a/trymos/image_build/files/usr/share/trymos/launch.sh
+++ b/trymos/image_build/files/usr/share/trymos/launch.sh
@@ -263,15 +263,9 @@
 
     pushd $tmpd
     info "Generating SSL certificates."
-
-    for ssl_app in cfssl cfssljson; do
-        curl --retry 5 --retry-delay 10 -L ${MIRANTIS_ARTIFACTORY_URL}/openstack/bin/utils/cfssl/${ssl_app} -o ${tmpd}/${ssl_app} && chmod +x ${tmpd}/${ssl_app}
-    done
-
-    # Generate SSL certs
     yq w ${CSR_CONF} "CN" "*.openstack.svc.${LOCAL_DOMAIN}" | \
     yq w -j - "hosts[+]" "*.openstack.svc.${LOCAL_DOMAIN}" | \
-    ${tmpd}/cfssl gencert -ca=${CERT_REPO_DIR}/ca.crt -ca-key=${CERT_REPO_DIR}/ca.key - | ${tmpd}/cfssljson -bare ${SSL_BARE_NAME}
+    cfssl gencert -ca=${CERT_REPO_DIR}/ca.crt -ca-key=${CERT_REPO_DIR}/ca.key - | cfssljson -bare ${SSL_BARE_NAME}
     mv ${tmpd}/${SSL_BARE_NAME}* ${CERT_REPO_DIR}
     popd
 }
diff --git a/trymos/image_build/scripts/binary.sh b/trymos/image_build/scripts/binary.sh
new file mode 100644
index 0000000..f0d41ea
--- /dev/null
+++ b/trymos/image_build/scripts/binary.sh
@@ -0,0 +1,20 @@
+set -ex
+
+LOCAL_BINARY_PATH='/usr/bin'
+
+declare -A binaries=(
+    ["${LOCAL_BINARY_PATH}/yq"]="${BINARY_BASE_URL}/openstack/bin/utils/yq/yq-v3.3.2"
+    ["${LOCAL_BINARY_PATH}/cfssl"]="${BINARY_BASE_URL}/openstack/bin/utils/cfssl/cfssl"
+    ["${LOCAL_BINARY_PATH}/cfssljson"]="${BINARY_BASE_URL}/openstack/bin/utils/cfssl/cfssljson"
+)
+
+function download {
+    local url=$1
+    local dst=$2
+    curl --retry 6 --retry-delay 10 -L ${url} -o ${dst}
+    chmod +x ${dst}
+}
+
+for bin in "${!binaries[@]}"; do
+    download ${binaries[${bin}]} ${bin}
+done
diff --git a/trymos/image_build/template.json b/trymos/image_build/template.json
index a6e0c89..3c2ee67 100644
--- a/trymos/image_build/template.json
+++ b/trymos/image_build/template.json
@@ -6,10 +6,20 @@
     "images_cache": "{{ env `PACKER_IMAGES_CACHE` }}",
     "image_base_url": "{{ env `IMAGE_BASE_URL` }}",
     "image_md5_url": "{{ env `IMAGE_MD5_URL` }}",
-    "vm_name": "{{ env `VM_NAME` }}"
+    "vm_name": "{{ env `VM_NAME` }}",
+    "binary_base_url": "{{ env `BINARY_BASE_URL` }}"
   },
   "provisioners": [
     {
+      "type": "shell",
+      "environment_vars": [
+          "BINARY_BASE_URL={{user `binary_base_url`}}"
+      ],
+      "scripts": [
+          "scripts/binary.sh"
+      ]
+    },
+    {
       "type": "file",
       "source": "./certs",
       "destination": "/srv/"